This PR adds API access via a local Unix socket on Unix systems allowing to
use the username of local user accessing the API as the authentication
username.
Configuration options are provided to map user names to roles similar to the
configfile authentication provider.
This will allow using Krill without authentication tokens if it is only
accessed via krillc on the same machine.
The PR also removes the example configuration files and moves the
documentation included in those files into a krill.conf.5 manual page. By
doing this, it simplifies the creation of the configuation file in the binary
packages. Those are now very minimal and only contain the mandatory config
options.
This PR brings back the built-in tree of downloaded RISwhois data rather
than using the Roto API. It does so using a memory-optimized tree
implementation and has a much smaller memory footprint than the previous
iteration. At the time of writing, the a full RISwhois dataset requires 55
megabytes of memory.
This PR also reverts the changes to the configuration. It removes the
bgp_api_enabled, bgp_api_uri, and bgp_api_cache_duration fields and adds
bgp_riswhois_enabled, bgp_riswhois_v4_uri, bgp_riswhois_v6_uri, and
bgp_riswhois_refresh_duration fields, all of which are optional.
Because of these config changes, the PR is a breaking change.
Breaking Changes
* Refactored command line options processing for all binaries. As a
result, options for both `krillc` and `krillta` have slightly changed.
For `krillc`, the `--server`, `--token`, `--format`, and `--api` options
are now before the first subcommand (since they affect all commands). For
`krillta`, those options are now after `krillta proxy` but before the next
subcommand, while `--format` is now after `krillta signer`. ([#1228])
* Removed support for RTA in `krillc`. Support is currently still
present in the Krill server, though behind a (non-default) feature flag.
([#1228])
* Changed how authorization works with OpenID Connect and configuration
files. Custom profiles have been replaced with a straightforward mapping
from access permission to roles and assigning roles to users. For
configuration file-based authentication, the file format has slightly
changed but the current format is still accepted. If you are using
OpenID Connect, you will have to update your configuration. Please, see
the manual for details. ([#1232])
* Replaced downloading of RISwhois file for ROA analysis with calls to the
[Roto API](https://github.com/NLnetLabs/roto-api). This can be
controlled via new configuration settings `bgp_api_enabled`,
`bgp_api_uri`, and `bgp_api_cache_seconds`. ([#1233], [#1266])
New
* Added a command to re-initialize the trust anchor signer with different
timing values or TAL URLs. ([#1255])
* Disables the protection against early re-issuance for CA certificates that
have the full resource set, typically TA certificates. ([#1281])
Bug Fixes
* Fixed a potential infinite recursion in PKCS11 error handling. ([#1215])
* Open ID connect: Re-initialize the connection after 60s to pick up
configuration changes at the provider. ([#1226])
* Fixed the naming of the trust anchor timing configuration. It was
expected to be `timing_config` for the config used by Krill and
`ta_timing` if used by the Krill TA signer. It is now `ta_timing` in
both cases while `timing_config` is accepted as an alias in both cases.
([#1241])
* Improve performance by using buffered reading and writing in the store.
([#1300], [#1301])
Other changes
* Refactored Prometheus metrics generation which resulted in a slightly
different formatting but should still be syntactically correct.
([#1249])
* Upgraded the bundled Krill UI to
[release 0.9.0](https://github.com/NLnetLabs/krill-ui/releases/tag/v0.9.0).
([#1295])
* Added packaging support for Ubuntu Noble, RHEL 10, Debian Trixie; removed
packaging support for Ubuntu Xenial and Bionic, and Debian Stretch.
([#1239], [#1297], [#1308])
* The minimum supported Rust version is now 1.85. ([#1288])
This RC was only made to properly test upgrading Debian packages. It does
not include any functional changes.
Other changes
* Do not include systemd unit files in krillta and krillup deb packages.
([#1313])
This PR prevents older versions of deb packages from including systemd-unit
files.
Because of the way Krill is set up, this requires both Ubuntu 20.04 and
Debian 11 to have usrmerge (which both have by default, only if upgraded
from an older version it might be missing).
Bug fixes
* Improved the message printed when the TA proxy’s signer request does not
contain any actual requests. ([#1305])
* Fixed various migration issues. ([#1306], [#1307], [#1309])
Other changes
* Add packaging for Debian 13. ([#1308])
* Updated dependencies. ([#1311])
Bug fixes
* Fix Krill refusing to start if the now unnecessary “refresh announcements
info” task is still present by adding it back as a dummy task. ([#1292])
* Fix redirect of `/` to `/ui` and allow additional segments on the `/ui`
path in the HTTP server. ([#1293])
Breaking Changes
* Refactored command line options processing for all binaries. As a
result, options for both `krillc` and `krillta` have slightly changed.
For `krillc`, the `--server`, `--token`, `--format`, and `--api` options
are now before the first subcommand (since they affect all commands). For
`krillta`, those options are now after `krillta proxy` but before the next
subcommand, while `--format` is now after `krillta signer`. ([#1228])
* Removed support for RTA in `krillc`. Support is currently still
present in the Krill server, though behind a (non-default) feature flag.
([#1228])
* Changed how authorization works with OpenID Connect and configuration
files. Custom profiles have been replaced with a straightforward mapping
from access permission to roles and assigning roles to users. For
configuration file-based authentication, the file format has slightly
changed but the current format is still accepted. If you are using
OpenID Connect, you will have to update your configuration. Please, see
the manual for details. ([#1232])
* Replaced downloading of RISwhois file for ROA analysis with calls to the
[Roto API](https://github.com/NLnetLabs/roto-api). This can be
controlled via new configuration settings `bgp_api_enabled`,
`bgp_api_uri`, and `bgp_api_cache_seconds`. ([#1233], [#1266])
New
* Added a command to re-initialize the trust anchor signer with different
timing values or TAL URLs. ([#1255])
* Disables the protection against early re-issuance for CA certificates that
have the full resource set, typically TA certificates. ([#1281])
Bug Fixes
* Fixed a potential infinite recursion in PKCS11 error handling. ([#1215])
* Open ID connect: Re-initialize the connection after 60s to pick up
configuration changes at the provider. ([#1226])
* Fixed the naming of the trust anchor timing configuration. It was
expected to be `timing_config` for the config used by Krill and
`ta_timing` if used by the Krill TA signer. It is now `ta_timing` in
both cases while `timing_config` is accepted as an alias in both cases.
([#1241])
Other changes
* Refactored Prometheus metrics generation which resulted in a slightly
different formatting but should still be syntactically correct.
([#1249])
* Added packaging support for Ubuntu Noble; removed packaging support for
Ubuntu Xenial and Bionic, and Debian Stretch. ([#1239])
* The minimum supported Rust version is now 1.85. ([#1288])
This PR upgrades to edition 2024.
This surfaces an interesting issue as std::env::set_var is unsafe. Krill
relies on various environment variables which are read throughout operation
and set to convey them to those points. This should be replaces by reading
those variables up front and conveying information by other means.
This PR adds caching of responses received from the BGP API. The caching
duration can be set via the new config variable `bgp_api_cache_seconds`
which defaults to 1800, i.e., 30 minutes.
This PR removes the static-openssl feature. If necessary, this features can
be invoked by selecting openssl/vendored directly.
The PR also removes building and testing with default features from the CI
workflow. The only difference between default and all features currently is
rta which is deprecated and will be removed, anyway.
This PR now also fixes a few issues in krillc config simple and the post
install scripts for Debian and RPM packages.
This is primarily related to #1251, which is fixed by upgrading
rpki to 0.18.6. However, whilst we're at it we might as well
upgrade the other dependencies as well. That also keeps
Dependabot happy.
This PR refactors and reorganizes a lot of code. It attempts to organize
things in a way that allows to keep more things private. Conversely, it
made the fields of many data-only structs pub and removed the creator,
accessor, and unpack methods for those.
The PR deliberately avoid any functional code changes given that due to
its sheer size, it is essentially unreviewable.
This is also why it stopped short of re-organizing the structure of the
actual server, ie., the Krillserver and the daemon::http module which
currently have a rather blurry distinction. A follow-up PR will create a
more clear separation but this requires code changes.
This PR imports the code previously in the kvx crate into Krill itself
as the commons::storage module. It also rearranges some of Krill’s
eventsourcing and queue code to better integrate with the now internal
storage module.
This PR restructures how authentication policies are used in Krill. It
removes the use of Oso and its policy definition language and instead
switches to simple, straightforward mappings between permissions, roles,
and users.
The existing concept of roles is augmented to serve as the central
configuration option for limiting a user’s access to certain action and
resources. Roles are now user configurable via the new auth_roles
configuration directive. For each role, a set of permissions has to be
provided. Optionally, a list of resource handles (vulgo: CAs) can be given
in which case access is limited to these resources.
The authentication providers now assign one of these roles to each logged
in user.
The OpenID Connect provider now only determines claims for “id,” i.e., the
user name, and the “role.” Since we replaced the previous use of JMES
paths with custom functions with a more stringent model of matching and
substitution, the configuration had to change in a non-compatible way,
anyway, so we cleaned it up a bit and switched from a map to an array for
the claims.
For the config file provider, this was already possible by adding a “role”
attribute. This has now been changed into a “role” field of the user
details. In order to make upgrading seamless, the “role” attribute is
still accepted but a deprecation warning is logged. Since the auth_users
configuration is not used for the OpenID Connect provider any more, the
password_hash and salt fields of the user details are now mandatory.
Custom policies have been removed.
This is a breaking change.
This PR changes how the clients -- krillc, krillta, as well as the
integration tests -- work to better fit the derive model provided by clap.
This results in basically everything in the cli module and all the
integration tests being different now.
The PR slightly changes the options for both krillc and krillta. For krillc,
the --server, --token, --format, and --api options are now before the first
subcommand (since they affect all commands). For krillta, those options are
now after krillta proxy but before the next subcommand, while --format is
now after krillta signer.
This PR also removes client support and integration tests for RTA.
This is a breaking change.
This PR upgrades the codebase to Rust edition 2021.
This mostly just means removing a number of use statements for TryFrom and
TryInto. There are no actual code changes.
This PR fixes all warnings from nightly Clippy as of today and enables a
Clippy run in the CI workflow for the stable channel with all features
enabled.
cryptoki itself is marked optional and only needed for hsm builds.
cryptoki-sys is still compiled unconditionally, also in builds
disabling the hsm feature. This causes build failures if cryptoki
isn't installed or on systems unsupported by cryptoki-sys's build
script.
